Sovereignty and Open Source [EOLE 2026]

Europe has rediscovered “sovereignty” through a wave of new regulation — Cyber Resilience Act, AI Act, cloud sovereignty tenders. EOLE 2026 takes the opposite starting point: Free Software, Open Source and open AI have been pursuing digital autonomy for forty years, long before the word “sovereignty” entered the policy lexicon. The 2026 cycle is therefore not a compliance forum on the new regulations. It is a year-long community effort — a kick-off webinar in late June, a shared working space, a flagship event in Q4 — to map the tools, licences, governance practices and communities through which openness already delivers sovereignty, and to reconnect the lawyers, technologists, public actors and academics who quietly sustain that infrastructure.

Sovereignty is not a compliance issue

Over the past two years, “digital sovereignty” has moved from the margins of European policy to the centre of nearly every legislative file: the Cyber Resilience Act, the AI Act, the EUR 180M Commission tender on cloud sovereignty, the rise of digital commons initiatives such as the French EDIC. The natural reflex is to treat sovereignty as the next compliance brief, and to gather lawyers around the new rulebooks.

EOLE 2026 takes the opposite path. Free Software, Open Source and now open AI have been building digital autonomy for forty years — through licences, standards, shared infrastructures, OSPOs, foundations, public-administration adoption, and communities of practice. Sovereignty, in any meaningful sense, has always been their working object. The most urgent task is not to map yet another regulation onto open ecosystems, but to re-anchor the conversation in the tools and practices that already deliver autonomy, and to make them legible to the wider legal and institutional community.

The 2026 cycle is built around that inversion. A public kick-off webinar in late June framed the different meanings of sovereignty — autonomy, resilience, institutional control, epistemic pluralism — and showed how each is already operationalised in open ecosystems. Between sessions, a lightweight community space (the EOLE forum) lets contributors from FSFE, Eclipse, Software Heritage, the OSPO Alliance, academia and public administrations co-build a cartography of existing tools, licences, governance practices and communities through which openness produces sovereignty. The cycle closes with the main event on 27 November 2026 in Barcelona, hosted at Universitat Pompeu Fabra.

In keeping with EOLE’s tradition, the goal is not to host another expert forum but to bring together — and make visible to one another — the people who collectively sustain this movement, and to reorient the European debate around what they already build.

If you want to keep up to date with all the news from the EOLE event, we invite you to subscribe to our newsletter.

Or, you can take part in our forum by sharing your experiences or useful resources on this year’s theme!

Main event in Barcelona

Friday 27 November 2026, Universitat Pompeu Fabra, Barcelona. Practical information (venue, access, lunch) and registration are on their own pages.

The themes

1. What does, and should, “open source” mean in EU law (CRA, AI Act, Data Act, tenders)? Each new EU text gives its own reading of “open source”. This table looks at the gap between the legal wording and what the community means, at when a project becomes a “product”, and at how to write a definition usable in regulation and in public tenders.
2. Funding sovereignty: public money, public code, mutualisation and virtuous public-private models Public money for sovereignty is flowing. This table looks at how it is structured: conditions to open what is publicly funded, contracts where the developer keeps the rights with an obligation to publish, mutualisation between administrations, and how to fund fundamental projects that nobody sees.
3. The cultural problem: mindsets, procurement and the people who say “no” in public administration In many countries the law favours open source and administrations still buy proprietary solutions. This table looks at the people and roles involved (procurement, legal services, technical teams, OSPOs), at what blocks adoption and reuse, and at the arguments that work.
4. Sovereign by design versus the global commons: nationality, lock-in and export control Open source projects draw contributions from everywhere. This table looks at what can be national or European in open source (skills, operations, hosting), at what “avoiding lock-in” means, and at the specific case of export-controlled and defence-related software.
5. Open source in the AI age: open weights versus open source AI, training data and the community Open-weights models and open source AI models are not the same thing. This table looks at what each one gives in terms of control, at use restrictions in model licences, at the dependence on hosted AI services, at training data, and at the role of the community when a large share of code is generated.
6. From control to the capacity to govern: addressing open source’s own weaknesses Sovereignty also means the ability to run, audit, maintain and adapt one’s own infrastructure. This table looks at the weaknesses of open source as infrastructure (funding, maintenance, security, maturity), at the measures that reduce them, and at what a trustworthy checklist for procuring and auditing “sovereign” systems could contain.

Each thread on the forum presents the theme in more detail: why it matters for sovereignty, what was said in June, what already exists to build on, and the open questions.

Indicative schedule

Time
09:30	Welcome coffee
10:00	Opening: the cycle so far, how the day works, opening intervention
10:30	Morning session: table discussions, two rounds
12:30	Lunch
14:00	Afternoon session: table discussions, two rounds
16:00	Reporting by the rapporteurs, open discussion
16:40	Closing remarks and next steps
17:00	End